Cookie Values Used in Anti-CSRF Token
Summary#
Invicti identified a cookie used as Anti-CSRF Token.
Impact#
During a cross-site scripting attack, an attacker might easily access cookies and hijack the victim's session even if cookie is marked as
HttpOnly. If the cookie is not the session cookie you can ignore this issue.
Remediation#
Avoid the usage of session cookie as Anti-CSRF Token.
Classifications#
Invicti Security Insights
Vulnerability Index
You can search and find all vulnerabilities
Select Category
OR
Search Vulnerability
Tags
Related Vulnerabilities
